DataSentinel is an enterprise-grade Data Security Posture Management (DSPM) tool that automates cloud security auditing, PII/PHI detection, and compliance reporting for AWS environments.
Built to address the growing need for automated data protection in healthcare and regulated industries.
- Multi-dimensional security analysis across S3 buckets
- Detects public access violations, missing encryption, disabled versioning
- Risk scoring algorithm (0-100) based on severity and compliance impact
- Real-time security posture assessment
- Healthcare-focused sensitive data detection (HIPAA/GDPR)
- Pattern matching for SSN, medical records, patient IDs, diagnosis codes
- Context-aware classification (veterinary medical data support)
- Automated risk level assignment (LOW/MEDIUM/HIGH/CRITICAL)
- Maps findings to HIPAA, GDPR, and SOX requirements
- Generates compliance gap analysis reports
- Provides regulation-specific remediation guidance
- Audit-ready documentation
- Policy-as-code enforcement engine
- One-click security fixes (encryption, versioning, access controls)
- Dry-run mode for safe testing
- Detailed remediation logging
- Executive-level security metrics visualization
- Drill-down capability into bucket-level findings
- Exportable compliance reports (JSON/HTML)
- Real-time risk trend analysis
DataSentinel/
├── src/
│ ├── scanner/ # S3 security configuration scanner
│ ├── detector/ # PII/PHI pattern detection engine
│ ├── reporter/ # HTML dashboard generator
│ └── remediation/ # Automated fix deployment
├── output/ # Scan results and reports
├── tests/ # Unit and integration tests
└── main.py # CLI orchestrator
- Python 3.8+
- AWS account with S3 access
- AWS credentials configured
# Clone repository
git clone https://github.com/yourusername/datasentinel.git
cd datasentinel
# Create virtual environment
python -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Configure AWS credentials
cp .env.example .env
# Edit .env with your AWS credentialsDataSentinel integrates with OpenAI's GPT-4 to provide intelligent, context-aware security recommendations:
- Prioritized remediation actions based on risk and compliance impact
- Strategic security roadmap recommendations
- Compliance gap analysis with specific regulatory citations
- Executive summaries for stakeholder communication
- Estimated remediation timelines for resource planning
- Analyzes scan results in real-time
- Provides tailored recommendations based on your specific findings
- Maps issues to business impact
- Generates audit-ready documentation
# Enable AI recommendations (requires OPENAI_API_KEY in .env)
python main.py
# Skip AI and use standard recommendations
python main.py --no-ai======================================================================
DataSentinel - DSPM & Security Scanner
======================================================================
[Phase 1] Security Configuration Scan
[*] Starting S3 security scan...
[+] Found 2 buckets to scan
[*] Scanning bucket: datasentinel-test-insecure-ztf1r4dc
Risk Score: 35/100
Issues Found: 2
[*] Scanning bucket: datasentinel-test-secure-ivpk91lp
Risk Score: 35/100
Issues Found: 2
[Phase 2] PII/PHI Data Discovery
[+] Report saved to output/security_scan_report.json
[Phase 3] Generating Standard Recommendations
======================================================================
📊 EXECUTIVE SUMMARY
======================================================================
Security scan identified 4 issues across 2 S3 buckets. 0 critical issues require immediate attention. Overall security posture shows a risk score of 35.0/100, indicating moderate need for remediation.
Compliance Risk Level: MEDIUM
Estimated Remediation Time: 2-4 hours for critical issues, 1-2 days for complete remediation
Top Priority Actions:
1. ⚠️ Enable AES-256 encryption on all buckets storing sensitive data
2. ✅ Implement continuous monitoring with automated scanning in CI/CD pipeline
======================================================================
✅ SCAN COMPLETE
======================================================================
Reports:
• output/comprehensive_scan_report.json
• output/security_scan_report.json
• output/ai_recommendations.json
Dashboard: output/dashboard.html
The tool generates an interactive HTML dashboard with:
- Real-time security metrics
- Compliance violation tracking
- Bucket-level risk breakdown
- Automated remediation commands
The interactive HTML dashboard includes:
With AI Mode (--no-ai not specified):
- 🤖 AI-generated executive summary
- 🎯 Prioritized remediation roadmap
- 📊 Compliance gap analysis
- ⏱️ Estimated remediation timelines
- 🔍 Risk-based recommendations
Standard Mode (--no-ai flag):
- 📊 Rule-based executive summary
- ✅ Standard security recommendations
- 📋 Compliance mapping
- 🎨 Full dashboard visualization
Both modes provide complete security analysis - AI mode adds intelligent, context-aware insights.
| Check | Description | Compliance |
|---|---|---|
| Public Access | Detects publicly accessible buckets | HIPAA 164.312, GDPR Art.32 |
| Encryption | Validates server-side encryption | HIPAA 164.312(a)(2)(iv) |
| Versioning | Ensures data recovery capability | HIPAA 164.308(a)(7)(ii)(A) |
| Access Logging | Verifies audit trail configuration | HIPAA 164.312(b), SOX |
| Sensitive Data | Scans for PII/PHI exposure | HIPAA 164.308, GDPR Art.5 |
- Social Security Numbers (SSN)
- Email addresses
- Phone numbers
- Credit card numbers
- Medical Record Numbers (MRN)
- Patient IDs
- Prescription numbers
- ICD diagnosis codes
- Healthcare context keywords
- Multi-cloud support (Azure Blob, GCP Storage)
- Machine learning-based anomaly detection
- Integration with SIEM platforms
- Automated incident response workflows
- Data lineage tracking
- Real-time monitoring with alerts
Contributions welcome! Please read CONTRIBUTING.md for guidelines.
Perfect for organizations managing regulated data in AWS environments.
Project Link: https://github.com/yourusername/datasentinel
⭐ Star this repo if you find it useful!